Securing Large Vision-Language Models via Deterministic Orchestration Layers

John6666
Tue, 30 Dec 2025 09:31:09 +0000

for now:

You are aiming at the right target: treat multimodal safety as a systems problem, not a weights problem. The open questions you listed are all “boundary” questions where naive ML solutions look good on a benchmark and then collapse under distribution shift, tool access, or latency constraints. The good news is that the literature now contains several concrete “similar cases” (hidden prompts in PDFs, image-scaling attacks, Unicode invisibles) that map directly onto your design space and can be used as calibration anchors. (arXiv)

Below is a detailed set of ideas for each open question, plus online cases, pitfalls, and a curated resource map.

0) Background: what you are actually trying to detect

Two different failure modes get conflated

1. Benign cross-modal inconsistency
Even strong multimodal models can answer differently when the same semantics are presented as text vs rendered text-in-image. This is now quantified directly by REST and REST+. (arXiv)
Implication: “OCR text embedding ≠ image embedding” is not automatically an attack.

2. Adversarial instruction smuggling
Hidden or obfuscated directives are placed where the system will parse them but humans will miss them (PDF hidden text, Unicode invisibles, scaling artifacts that reveal text to the model, etc.). (arXiv)
Implication: you need security signals that correlate with intentional mismatches, not just mismatches.

So your scoring needs to separate:

“Model is flaky here” (handle with escalation / safe fallback), from

“Input is adversarial” (fail closed, restrict tool privileges, sanitize/strip channels).

REST/REST+ is useful because it proves the first class exists at meaningful rates. (arXiv)
RIO-Bench is useful because it shows “just ignore text” is not viable. (arXiv)

1) Semantic Dissonance Score (Sdiss) under 50 ms

1.1 Why “manifold divergence” is attractive but easy to misuse

You have (at inference time) a tiny sample: one image, one OCR output, and maybe a few ROIs. True manifold divergence estimation is statistically hungry. If you treat it like a textbook two-sample test, it will be unstable.

The workable reframing is:

You are not estimating a global divergence between two distributions.

You are computing a fast, adversary-resistant risk score from multiple cheap, partially-independent indicators.

REST/REST+ already reports that “modality gap” correlates with inconsistency. That is exactly the right primitive, but it must be calibrated by content strata (text density, resolution, language, vision token count). (arXiv)

1.2 Sdiss v0 that is cheap and hard to game

Make Sdiss an ensemble. Each component is cheap, each fails differently.

A practical Sdiss decomposition:

A) Global modality gap (fast)

Embed image: e_img

Embed OCR text (after normalization): e_txt

Score: gap_global = 1 - cos(e_img, e_txt)
REST/REST+ gives you justification that this correlates with inconsistency. (arXiv)

B) Localized ROI MaxSim gap (still cheap)

Take top-K OCR boxes (cap K hard, ex: 8–20).

Compute ROI image embeddings or patch embeddings for those boxes.

Compute MaxSim between ROI embeddings and the text embedding of that span.

Score: gap_roi = max_i (1 - maxsim(roi_i, span_i))

This catches “small hidden instruction blob” cases that global pooling misses.

C) Text-channel spoof / invisibles risk (microseconds to sub-ms)
Run Unicode security checks on every extracted text stream (OCR output, PDF text streams, HTML, metadata).
Use UTS #39 confusables skeletons and mixed-script checks. (Unicode)
If you want production-grade primitives, ICU SpoofChecker exposes the “skeleton” approach used to detect confusables efficiently. (Unicode Consortium)

This component is critical because some attacks are “visually identical, tokenization different” (variation selectors). (arXiv)

D) Directive-density / instruction-shape detector (cheap rules + tiny model)
You do not need deep semantics here. You need “is this text shaped like an override”.

Imperative verbs, control phrases, tool-invocation patterns, “ignore previous”, etc.

Weight by OCR confidence and by Unicode risk.

This maps to the OWASP framing: prompt injection is about confusing instructions vs data. (OWASP Gen AI Security Project)

E) View-consistency under controlled transforms (small extra cost, high value)
Many stealth attacks exploit the model’s preprocessing, not the original pixels. Image scaling attacks are now documented in the wild, with open tooling (Anamorpher). (The Trail of Bits Blog)
So compute embeddings and OCR on:

“raw” view

“model-view” (exact resize / crop pipeline you feed the LVLM)

optionally 1–2 alternate resamplers (nearest, bilinear, bicubic) if you can afford it

Score: instability = max_view gap_global(view) or “text appears only after downscale”.

1.3 Putting it together: Sdiss as a policy-grade risk score

A simple structure that behaves well under adversarial pressure:

Sdiss = w1*gap_global + w2*gap_roi + w3*unicode_risk + w4*directive_density + w5*view_instability

plus a confidence channel:

OCR mean confidence, text coverage, number of boxes used, language ID stability.

Then define deterministic outcomes:

Allow: low Sdiss and high confidence.

Allow but tool-readonly: moderate Sdiss or low confidence.

Refuse / escalate: high Sdiss, or “directive-shaped text + unicode risk”, or “text appears only in model-view”.

This matches the “dissonance is danger” principle, but prevents over-refusal by separating benign inconsistency from adversarial features (Unicode risk, view-instability, directive-shape). REST/REST+ is your argument for requiring the stratified calibration, not a single threshold. (arXiv)

1.4 How to keep this under 50 ms

You win on latency by enforcing caps:

Cap OCR boxes.

Run OCR once on raw, once on model-view only if needed.

Use a single dual-encoder family for embeddings so everything is dot products.

Quantize embedding model or run it on GPU if available.

The key is that most of Sdiss is vector math + string checks.

1.5 Known similar cases online (why these components matter)

Hidden prompts in structured docs (PDF/HTML) and principled detection methods exist (PhantomLint). (arXiv)

Hidden prompts in manuscripts and “inject-and-detect” editorial strategies show the attack is not theoretical. (arXiv)

Image scaling prompt injection exists with open-source tooling and mitigation discussion. (The Trail of Bits Blog)

Unicode invisibles (variation selectors) enable “looks identical” jailbreaks and have released code. (arXiv)

2) Outcome-weighted penalties for adversarial image clusters (SRF-style) without killing recall

2.1 Background: why “cluster penalty” is risky

Penalizing dense clusters naively destroys exactly what you want in vision retrieval: near-duplicates (same product, same UI, same document template) are often the best evidence.

So the correct goal is not “penalize clusters”. It is:

penalize suspicious neighborhoods, conditional on other attack signals.

2.2 A safe pattern: two-score decomposition

Split retrieval scoring into:

Utility score: similarity to query (dense, sparse, late-interaction).

Risk score: “this candidate or its neighborhood looks adversarial”.

Then combine conservatively:

If risk is low: do not touch utility ordering.

If risk is high (or Sdiss high): apply penalties.

This mirrors how modern security systems treat signals: a single weak signal should not dominate.

2.3 What risk signals work for image embeddings

You want risk signals that are:

cheap to compute offline or in-ranking,

hard for attackers to optimize simultaneously.

Good options:

A) Neighborhood anomaly metrics (offline)

kNN distance distribution anomalies

Local Outlier Factor style scores

sudden density spikes in narrow regions of embedding space

B) Embedding stability under benign augmentations (offline)
Attack noise often creates instability under small transforms.
Compute Var(e_img(transform_j)) across a few benign transforms.
This is the embedding analogue of “adversarial training detects sensitivity”.

C) Provenance and corpus trust
Signed corpora, source whitelists, freshness, human-curated sources. This becomes a prior.

2.4 An “outcome-weighted” penalty that preserves recall

A practical recipe:

1. Retrieve top-N with your normal stack (maximize recall).

2. Compute risk(doc) and risk_cluster(doc) (cluster risk can be mean risk of its kNN).

3. Compute a consensus score within the candidate set:

If a doc’s claims (or captions) are contradictory to most others, raise risk.

This is conceptually aligned with “consistent majority” methods used in graph-robust RAG. (arXiv)

4. Combine:

If Sdiss low: score = utility

If Sdiss moderate: score = utility - λ*risk

If Sdiss high: score = utility - λ1*risk - λ2*risk_cluster

This is “outcome-weighted” because the penalty activates when upstream evidence suggests attack conditions.

2.5 Where to implement penalties (Vespa vs Qdrant)

If you need deterministic, low-latency penalties:

Vespa phased ranking lets you bound compute via rerank-count. (Vespa документация)

ONNX in ranking lets you run small risk models inside the ranking pipeline. (Vespa документация)

If you prioritize experimentation:

Qdrant’s docs and ecosystem show flexible pipelines, but model-based scoring tends to be external unless you redesign around precomputed priors. (Qdrant)
Also, real-world issues exist around multivector query usage, which matters if you rely on late interaction heavily. (GitHub)

3) Interference between visual sanitization (blur/denoise) and OCR-based injection detection

3.1 Why this interference is real

Aggressive blur reduces high-frequency detail, which is exactly what OCR needs. At the same time, blur can reduce adversarial pixel perturbations.

RIO-Bench formalizes the deeper problem: systems must learn when to “read” vs “ignore” text, not always one or the other. (arXiv)

3.2 The correct systems solution: multi-view branching, not compromise

Use two parallel views, always:

View A (raw): optimized for OCR and typography forensics.

View B (sanitized): optimized for embedding robustness and semantic perception.

Then add a consistency check across them:

If OCR text changes drastically between raw and sanitized, that is itself a risk signal.

If text appears only after resizing (model-view), treat as high risk, because scaling attacks explicitly exploit that. (The Trail of Bits Blog)

3.3 A balancing policy that is deterministic

Examples of clean decision rules:

If unicode_risk high OR directive_density high, ignore OCR text as instruction source and restrict tools.

If OCR_confidence low AND gap_roi high, fail closed for tool actions.

If model-view reveals new text (not present in raw), treat as suspected injection and refuse or require human confirmation.

This is exactly the “instructions vs data” separation OWASP emphasizes, implemented mechanically. (OWASP Gen AI Security Project)

3.4 Practical pitfall: resampling is part of the attack surface

Trail of Bits’ scaling attack writeup matters for LVLMs because the “model-view” is often a resized image. If you do not analyze what the model actually sees, you miss entire classes of hidden text. (The Trail of Bits Blog)

4) Cost of provable robustness: MIS filtering at 10M+ with Vespa phased ranking

4.1 The key observation

MIS-style filtering is only tractable if you do it on top-N retrieved candidates, not on the full corpus.

ReliabilityRAG’s core idea is MIS on a contradiction graph plus reliability priors, with provable robustness under assumptions. (arXiv)
Your systems question is: how to keep this within p95 latency budgets.

4.2 Latency anatomy of “MIS filtering”

For a candidate set size N:

Building a full contradiction graph is O(N^2) edge decisions.

MIS is NP-hard in general, so you use greedy or specialized variants.

So the Pareto knobs are:

1. N (candidate set size)

2. Edge budget (how many pairs you actually score)

3. Edge scorer cost (rules vs small NLI vs cross-encoder)

4.3 A Vespa-native way to implement the Pareto frontier

Vespa gives you two mechanisms to control cost explicitly:

A) Phased ranking with rerank-count

First-phase: fast retrieval and cheap features.

Second-phase: run more compute on top K per node (bounded by rerank-count). (Vespa документация)

Global-phase: expensive final rerank after merge, again bounded. (Vespa документация)

B) ONNX inside ranking
Run small risk models (poisoning risk, contradiction likelihood) inside the ranking pipeline. (Vespa документация)

A practical architecture:

1. Retrieve top N0 (example 200–1000) with cheap scoring.

2. Second-phase rerank to N (example 50–200) using reliability priors + cheap risk.

3. Global-phase computes the heavier contradiction edges only among the final N (or even a pruned subset), then selects the consistent set.

This matches Vespa’s intended scaling model: spend compute only on the best hits. (Vespa документация)

4.4 What “provable” costs you in production

Two practical warnings:

Warning 1: the guarantee depends on edge precision
ReliabilityRAG assumes contradiction edges reflect truth sufficiently well. If your edge model is noisy, you can drop correct evidence. (arXiv)
So you should bias toward high precision, even if recall is lower. That usually means conservative rules plus selective heavier verification for only borderline pairs.

Warning 2: fail-closed increases over-refusal risk
Fail-closed is correct for tool execution, but it can create user-visible refusal spikes. OR-Bench exists because over-refusal is now a measured failure mode. (arXiv)
So your policy should distinguish:

“refuse tool/action”

“still answer safely in text, but with limited claims”

5) “Similar cases, issues online” that directly map to your design

These are the most relevant real-world-adjacent cases to study and replay in your harness:

1. Hidden prompts in PDFs and structured documents

PhantomLint is explicitly about principled detection of hidden prompts in PDF/HTML. (arXiv)

Peer-review prompt injection incidents have been studied, including real manuscript cases. (arXiv)

2. Image preprocessing attacks (scaling)

Trail of Bits documents “weaponizing image scaling” and provides Anamorpher tooling. (The Trail of Bits Blog)

3. Unicode invisibles and confusables

Variation selector jailbreaks show “looks identical” can still tokenize differently, and code is available. (arXiv)

Unicode UTS #39 and ICU SpoofChecker provide the standard detection mechanisms. (Unicode)

4. Prompt injection as a top-tier system risk

OWASP GenAI risk taxonomy frames prompt injection as a primary application risk. (OWASP Gen AI Security Project)

This matters because your orchestrator is ultimately a “confused deputy” defense.

6) Curated high-value resources to build on (papers, tools, docs)

Benchmarks and papers

REST / REST+ (cross-modal inconsistency, modality gap correlation). (arXiv)

RIO-Bench (selective reading vs ignoring text, typographic attacks). (arXiv)

ReliabilityRAG (MIS + reliability priors, provable robustness framing). (arXiv)

PhantomLint (hidden prompt detection for PDF/HTML). (arXiv)

Imperceptible jailbreaking via Unicode variation selectors (and released code). (arXiv)

Tooling and standards

Unicode UTS #39 confusables and security mechanisms. (Unicode)

ICU SpoofChecker API reference (practical confusable detection primitives). (Unicode Consortium)

Anamorpher (open-source image scaling attack tool) + writeup. (GitHub)

Retrieval infrastructure docs

Vespa phased ranking and rerank-count controls. (Vespa документация)

Vespa ranking with ONNX models. (Vespa документация)

Vespa cross-encoder performance scaling discussion (rerank-count, model size, sequence length). (Vespa документация)

Qdrant PDF retrieval at scale tutorial (useful for multimodal doc pipelines). (Qdrant)

Qdrant multivector edge-case issue (engineering pitfalls). (GitHub)

7) Concrete suggestions for your implementation path

1. Implement Sdiss as an ensemble with a confidence channel.
Do not bet on one “manifold divergence” statistic. Use global gap, ROI gap, Unicode risk, directive-shape, and view-instability. Anchor calibration with REST/REST+ and RIO-Bench. (arXiv)

2. Add “model-view” analysis as mandatory.
Scaling attacks prove the model’s resize pipeline is part of the threat surface. (The Trail of Bits Blog)

3. Make outcome-weighted penalties conditional.
Only activate cluster penalties when upstream signals indicate risk. This preserves benign near-duplicate recall.

4. Do MIS-like filtering only on a bounded top-N with explicit budgets.
Use Vespa rerank-count to force predictable compute. (Vespa документация)

5. Separate “refuse tool/action” from “refuse answer.”
This reduces over-refusal while staying fail-closed for execution. OR-Bench is a useful regression target. (arXiv)

Summary bullets

Sdiss should be an ensemble risk score, not a single divergence metric, because benign cross-modal inconsistency is real and measurable. (arXiv)

Add Unicode confusable checks and model-view resize checks because real attacks exploit invisibles and preprocessing. (Unicode)

Outcome-weighted penalties should be conditional on risk signals to preserve near-duplicate recall.

MIS filtering is practical only on top-N, and Vespa phased ranking gives explicit cost control via rerank-count and ONNX-in-ranking. (Vespa документация)